If you lose money to a phishing scam, a natural first question is whether anyone else has to share the loss. In Singapore, the answer may lie in the Shared Responsibility Framework, or SRF. This shared responsibility framework scam guide explains when banks and telcos may have to cover phishing losses, which scams are covered, what is expected of you and how a claim works.
It focuses on who bears the loss, not on the steps to take straight after a scam. It is general information, not financial or legal advice. The framework is set by the Monetary Authority of Singapore (MAS) and the Infocomm Media Development Authority (IMDA). Check their websites for the current rules, which can be updated.
What the Shared Responsibility Framework Is
The SRF took effect in December 2024. Its purpose is to make the organisations that run Singapore’s banking and mobile networks take on clear anti-scam duties, and to make them pay towards a victim’s losses if they fail to carry out those duties.
The framework covers two groups:
- Responsible financial institutions. These include the major retail banks and certain payment service providers that hold customers’ money, such as larger digital wallet providers. MAS publishes which kinds of institutions are covered.
- Telecommunication operators. These are mobile network operators and the companies that handle SMS delivery, supervised by IMDA.
The idea is shared responsibility. Banks, telcos and consumers each have a role in preventing scams, and losses follow whoever fell short.
Which Scams the SRF Covers
The SRF is deliberately narrow. It mainly covers phishing scams with a digital link to Singapore, where:
- a scammer impersonates a legitimate business or government body through a digital channel, such as an SMS, email, messaging app or website;
- the victim clicks a link and enters their banking credentials or one-time password on a fake site, or otherwise gives them away; and
- the scammer then uses those credentials to make transactions the victim did not authorise.
Several common scam types fall outside the SRF, including:
- Scams where you make the transfer yourself, such as investment, job, love or impersonation scams where you are persuaded to send money. These are often called authorised payment scams.
- Malware scams, where a malicious app takes over your phone. These are handled under separate guidance.
If your loss is outside the SRF, other protections, such as the E-Payments User Protection Guidelines for unauthorised transactions, may still apply. Ask your bank which rules it is using to assess your case.
The Loss Waterfall: Who Pays First
The heart of the SRF is a “waterfall” that decides who bears the loss, in order. This table summarises how it works.
| Order | Party | When they bear the loss | Examples of duties checked |
|---|---|---|---|
| First | Responsible financial institution | If it breached one or more of its SRF duties | Cooling-off period after a digital token is activated, real-time alerts for transactions, a 24/7 reporting channel and self-service kill switch |
| Second | Telco | If the financial institution met its duties but the telco breached its SRF duties | Sending SMS only through authorised channels, blocking unregistered Sender IDs, filtering SMS containing known malicious links |
| Third | Consumer | If neither the financial institution nor the telco breached their duties | Consumer is generally expected to bear the loss, though other assessments may still apply |
In plain terms, the bank is checked first. If the bank did everything the framework requires, the telco is checked next. If both did what was required, the loss generally stays with the consumer.
What Banks and Telcos Must Do
Banks and covered payment providers must put in place a set of anti-scam measures. Examples MAS has described include:
- a cooling-off period after a digital security token is activated on a new device, during which high-risk transactions are restricted;
- notifications when a digital token is activated or when high-risk activities, such as changes to transaction limits, take place;
- real-time alerts for outgoing transactions; and
- a round-the-clock reporting channel and a self-service “kill switch” to freeze accounts quickly.
Telcos must take steps that make it harder for scam SMS messages to reach you, such as only connecting SMS with alphanumeric Sender IDs from authorised aggregators, blocking messages using Sender IDs that are not registered under Singapore’s SMS Sender ID Registry, and using filters to block SMS containing known malicious links.
The specific duties and how they are measured are set out by MAS and IMDA, and may be refined over time.
What You Are Expected to Do
The SRF does not remove your responsibility. Consumers are expected to follow good security habits and to act quickly. To give yourself the best chance:
- Turn on and read your transaction notifications. Do not switch off alerts, because they help you spot fraud early.
- Never share credentials or one-time passwords, and do not enter them on sites reached through links in messages.
- Report quickly. If you suspect a scam, contact your bank through its official hotline or app straight away and use the kill switch if needed. Make a police report as well.
- Keep evidence. Screenshots of the scam messages, links, call logs and transaction alerts all help the investigation.
For more on everyday money safety, the guidance from MAS, the Singapore Police Force and the National Crime Prevention Council’s ScamShield resources is a good place to start.
How a Claim Under the SRF Works
Claims start with your bank or payment provider, not with the telco. In general:
- Report the incident to your financial institution as soon as you can, and tell it you want your case assessed under the SRF.
- The financial institution investigates, including checking whether it met its own duties and, where relevant, working with the telco to check theirs.
- You receive an outcome explaining who bears the loss and why.
- If you disagree, you can ask for a review through the institution’s complaints process. Disputes with financial institutions may be escalated to the Financial Industry Disputes Resolution Centre (FIDReC). Check FIDReC’s website for its current scope and process.
Timelines and documentation requirements are set by the framework and by each institution, so ask your bank what to expect.
Common Misunderstandings
- “The bank always pays.” Not true. The bank only bears the loss if it breached its SRF duties.
- “Any scam is covered.” No. Scams where you authorised the transfer yourself, and malware scams, are outside the SRF.
- “Telcos are first in line.” No. The financial institution is assessed first.
- “I can wait before reporting.” Delay can hurt your case and give scammers more time. Report immediately.
Staying Protected
The Shared Responsibility Framework gives phishing victims in Singapore a clearer path to having losses shared when banks or telcos fall short. But the best outcome is still not to be scammed at all. Keep alerts on, never share your credentials, report quickly and check the MAS and IMDA websites for the latest version of the rules.
Official sources: Monetary Authority of Singapore (MAS)